1

A security review replied that we have an incorrect content-type. There was no content-type stated so it defaulted to text/html.

However the page was just encoded - Fiddler gives the option to decode it in this page and then it renders (as with the other pages) in normal text/html.

What should the content-type be of a encoded page?

  • if the audit came back saying it was incorrect, what did it say it should be? – schroeder Apr 12 '17 at 6:58
  • 2
    What do you mean by "encoded"? – Arminius Apr 12 '17 at 6:58
  • They did not say what it should be, they just stated it was set as text/html and the reviewer pointed me to my fiddler instance where the heading in fiddler states "Response body is encoded. Click to decode".I think at this point the auditors PenTest did not see HTML tags and said it was not HTML – Peter PitLock Apr 12 '17 at 7:09
  • You need to talk to your testers, then. It's their finding, that means they are responsible for advising on remediation (or at least what they were expecting). – schroeder Apr 12 '17 at 7:42
  • 1
    you should set your default to text/plain – dandavis Apr 12 '17 at 7:44
3

The Content-Encoding of the page is unrelated to the Content-Type. Content-Encoding specifies how the content is compressed (i.e. gzip, deflate, br...) and thus how it should be decompressed. Content-Type instead specifies how the content should be interpreted, i.e. as html, image, PDF etc. And for text data like plain text or HTML it can additionally specify the character set and encoding, i.e. UTF-8, ISO-8859-1 or similar.

If no Content-Type is specified browsers try to guess what the type and character set/encoding the content might be. This can have unintended side effects because different browsers might guess differently and specifically the dedected character set might also depend on various contexts like the character set of an embedding frame.

Thus you should always specify a Content-Type and also set the Charset parameter for text types. Additionally you should set the HTTP header X-Content-Type-Options: nosniff so that the browser does not try to guess the type even though the declared is differently from the guessed type.

For more information about the problem with MIME sniffing see also MIME Sniffing: feature or vulnerability, Attacks on browser-based content sniffing, Secure Content Sniffing for Web Browsers or How to Stop Papers from Reviewing Themselves.

  • Thanks Steffen, I will keep it to text/html and inform the pentester – Peter PitLock Apr 12 '17 at 7:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.